diff --git a/integrations/api_repo_test.go b/integrations/api_repo_test.go index c789cc9ee..aec8c8f81 100644 --- a/integrations/api_repo_test.go +++ b/integrations/api_repo_test.go @@ -262,3 +262,26 @@ func TestAPIRepoMigrate(t *testing.T) { session.MakeRequest(t, req, testCase.expectedStatus) } } + +func TestAPIOrgRepoCreate(t *testing.T) { + testCases := []struct { + ctxUserID int64 + orgName, repoName string + expectedStatus int + }{ + {ctxUserID: 1, orgName: "user3", repoName: "repo-admin", expectedStatus: http.StatusCreated}, + {ctxUserID: 2, orgName: "user3", repoName: "repo-own", expectedStatus: http.StatusCreated}, + {ctxUserID: 2, orgName: "user6", repoName: "repo-bad-org", expectedStatus: http.StatusForbidden}, + } + + prepareTestEnv(t) + for _, testCase := range testCases { + user := models.AssertExistsAndLoadBean(t, &models.User{ID: testCase.ctxUserID}).(*models.User) + session := loginUser(t, user.Name) + + req := NewRequestWithJSON(t, "POST", fmt.Sprintf("/api/v1/org/%s/repos", testCase.orgName), &api.CreateRepoOption{ + Name: testCase.repoName, + }) + session.MakeRequest(t, req, testCase.expectedStatus) + } +} diff --git a/routers/api/v1/repo/repo.go b/routers/api/v1/repo/repo.go index c6c5d4aec..044b1e9c1 100644 --- a/routers/api/v1/repo/repo.go +++ b/routers/api/v1/repo/repo.go @@ -257,13 +257,15 @@ func CreateOrgRepo(ctx *context.APIContext, opt api.CreateRepoOption) { return } - isOwner, err := org.IsOwnedBy(ctx.User.ID) - if err != nil { - ctx.ServerError("IsOwnedBy", err) - return - } else if !isOwner { - ctx.Error(403, "", "Given user is not owner of organization.") - return + if !ctx.User.IsAdmin { + isOwner, err := org.IsOwnedBy(ctx.User.ID) + if err != nil { + ctx.ServerError("IsOwnedBy", err) + return + } else if !isOwner { + ctx.Error(403, "", "Given user is not owner of organization.") + return + } } CreateUserRepo(ctx, org, opt) }